keychain/ckks/CKKSViewManager.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSViewManager.h"
  25 #import "keychain/ckks/CKKSKeychainView.h"
  26 #import "keychain/ckks/CKKSSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSKey.h"
  28 #import "keychain/ckks/CKKSZoneStateEntry.h"
  29 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  30 #import "keychain/ckks/CKKSNotifier.h"
  31 #import "keychain/ckks/CKKSCondition.h"
  32 #import "keychain/ckks/CloudKitCategories.h"
  33 #import "keychain/categories/NSError+UsefulConstructors.h"
  34
  35 #import "keychain/ot/OTDefines.h"
  36
  37 #import "SecEntitlements.h"
  38
  39 #include <securityd/SecDbItem.h>
  40 #include <securityd/SecDbKeychainItem.h>
  41 #include <securityd/SecItemSchema.h>
  42 #include <Security/SecureObjectSync/SOSViews.h>
  43
  44 #import <Foundation/NSXPCConnection.h>
  45 #import <Foundation/NSXPCConnection_Private.h>
  46
  47 #include <Security/SecureObjectSync/SOSAccount.h>
  48 #include <Security/SecItemBackup.h>
  49
  50 #if OCTAGON
  51 #import <CloudKit/CloudKit.h>
  52 #import <CloudKit/CloudKit_Private.h>
  53
  54 #import <SecurityFoundation/SFKey.h>
  55 #import <SecurityFoundation/SFKey_Private.h>
  56
  57 #import "CKKSAnalytics.h"
  58 #endif
  59
  60 @interface CKKSViewManager () <NSXPCListenerDelegate>
  61 #if OCTAGON
  62 @property NSXPCListener *listener;
  63
  64 // Once you set these, all CKKSKeychainViews created will use them
  65 @property (readonly) Class<CKKSFetchRecordZoneChangesOperation> fetchRecordZoneChangesOperationClass;
  66 @property (readonly) Class<CKKSFetchRecordsOperation> fetchRecordsOperationClass;
  67 @property (readonly) Class<CKKSQueryOperation> queryOperationClass;
  68 @property (readonly) Class<CKKSModifySubscriptionsOperation> modifySubscriptionsOperationClass;
  69 @property (readonly) Class<CKKSModifyRecordZonesOperation> modifyRecordZonesOperationClass;
  70 @property (readonly) Class<CKKSAPSConnection> apsConnectionClass;
  71 @property (readonly) Class<CKKSNotifier> notifierClass;
  72 @property (readonly) Class<CKKSNSNotificationCenter> nsnotificationCenterClass;
  73
  74 @property NSMutableDictionary<NSString*, CKKSKeychainView*>* views;
  75
  76 @property NSMutableDictionary<NSString*, SecBoolNSErrorCallback>* pendingSyncCallbacks;
  77 @property CKKSNearFutureScheduler* savedTLKNotifier;;
  78 @property NSOperationQueue* operationQueue;
  79
  80 @property NSMapTable<dispatch_queue_t, id<CKKSPeerUpdateListener>>* peerChangeListeners;
  81 #endif
  82 @end
  83
  84 #if OCTAGON
  85 @interface CKKSViewManager (lockstateTracker) <CKKSLockStateNotification>
  86 @end
  87 #endif
  88
  89 @implementation CKKSViewManager
  90 #if OCTAGON
  91
  92 - (instancetype)initCloudKitWithContainerName: (NSString*) containerName usePCS:(bool)usePCS {
  93     return [self initWithContainerName:containerName
  94                                 usePCS:usePCS
  95   fetchRecordZoneChangesOperationClass:[CKFetchRecordZoneChangesOperation class]
  96             fetchRecordsOperationClass:[CKFetchRecordsOperation class]
  97                    queryOperationClass:[CKQueryOperation class]
  98      modifySubscriptionsOperationClass:[CKModifySubscriptionsOperation class]
  99        modifyRecordZonesOperationClass:[CKModifyRecordZonesOperation class]
 100                     apsConnectionClass:[APSConnection class]
 101              nsnotificationCenterClass:[NSNotificationCenter class]
 102                          notifierClass:[CKKSNotifyPostNotifier class]];
 103 }
 104
 105 - (instancetype)initWithContainerName: (NSString*) containerName
 106                                usePCS: (bool)usePCS
 107  fetchRecordZoneChangesOperationClass: (Class<CKKSFetchRecordZoneChangesOperation>) fetchRecordZoneChangesOperationClass
 108            fetchRecordsOperationClass: (Class<CKKSFetchRecordsOperation>)fetchRecordsOperationClass
 109                   queryOperationClass: (Class<CKKSQueryOperation>)queryOperationClass
 110     modifySubscriptionsOperationClass: (Class<CKKSModifySubscriptionsOperation>) modifySubscriptionsOperationClass
 111       modifyRecordZonesOperationClass: (Class<CKKSModifyRecordZonesOperation>) modifyRecordZonesOperationClass
 112                    apsConnectionClass: (Class<CKKSAPSConnection>) apsConnectionClass
 113             nsnotificationCenterClass: (Class<CKKSNSNotificationCenter>) nsnotificationCenterClass
 114                         notifierClass: (Class<CKKSNotifier>) notifierClass
 115 {
 116     if(self = [super init]) {
 117         _fetchRecordZoneChangesOperationClass = fetchRecordZoneChangesOperationClass;
 118         _fetchRecordsOperationClass = fetchRecordsOperationClass;
 119         _queryOperationClass = queryOperationClass;
 120         _modifySubscriptionsOperationClass = modifySubscriptionsOperationClass;
 121         _modifyRecordZonesOperationClass = modifyRecordZonesOperationClass;
 122         _apsConnectionClass = apsConnectionClass;
 123         _nsnotificationCenterClass = nsnotificationCenterClass;
 124         _notifierClass = notifierClass;
 125
 126         _container = [self makeCKContainer: containerName usePCS:usePCS];
 127         _accountTracker = [[CKKSCKAccountStateTracker alloc] init:self.container nsnotificationCenterClass:nsnotificationCenterClass];
 128         _lockStateTracker = [[CKKSLockStateTracker alloc] init];
 129         [_lockStateTracker addLockStateObserver:self];
 130         _reachabilityTracker = [[CKKSReachabilityTracker alloc] init];
 131
 132         _zoneChangeFetcher = [[CKKSZoneChangeFetcher alloc] initWithContainer:_container
 133                                                                    fetchClass:fetchRecordZoneChangesOperationClass
 134                                                           reachabilityTracker:_reachabilityTracker];
 135
 136         _operationQueue = [[NSOperationQueue alloc] init];
 137
 138         // Backwards from how we'd like, but it's the best way to have weak pointers to CKKSPeerUpdateListener.
 139         _peerChangeListeners = [NSMapTable strongToWeakObjectsMapTable];
 140
 141         _views = [[NSMutableDictionary alloc] init];
 142         _pendingSyncCallbacks = [[NSMutableDictionary alloc] init];
 143
 144         _initializeNewZones = false;
 145
 146         _completedSecCKKSInitialize = [[CKKSCondition alloc] init];
 147
 148         __weak __typeof(self) weakSelf = self;
 149         _savedTLKNotifier = [[CKKSNearFutureScheduler alloc] initWithName:@"newtlks"
 150                                                                     delay:5*NSEC_PER_SEC
 151                                                          keepProcessAlive:true
 152                                                 dependencyDescriptionCode:CKKSResultDescriptionNone
 153                                                                     block:^{
 154             [weakSelf notifyNewTLKsInKeychain];
 155         }];
 156
 157         _listener = [NSXPCListener anonymousListener];
 158         _listener.delegate = self;
 159         [_listener resume];
 160
 161         // If this is a live server, register with notify
 162         if(!SecCKKSTestsEnabled()) {
 163             int token = 0;
 164             notify_register_dispatch(kSOSCCCircleOctagonKeysChangedNotification, &token, dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^(int t) {
 165                 // Since SOS doesn't change the self peer, we can reliably just send "trusted peers changed"; it'll be mostly right
 166                 secnotice("ckksshare", "Received a notification that the SOS Octagon peer set changed");
 167                 [weakSelf sendTrustedPeerSetChangedUpdate];
 168             });
 169         }
 170     }
 171     return self;
 172 }
 173
 174 -(CKContainer*)makeCKContainer:(NSString*)containerName usePCS:(bool)usePCS {
 175     CKContainer* container = [CKContainer containerWithIdentifier:containerName];
 176     if(!usePCS) {
 177         CKContainerOptions* containerOptions = [[CKContainerOptions alloc] init];
 178         containerOptions.bypassPCSEncryption = YES;
 179
 180         // We don't have a great way to set these, so replace the entire container object
 181         container = [[CKContainer alloc] initWithContainerID: container.containerID options:containerOptions];
 182     }
 183     return container;
 184 }
 185
 186 - (void)setupAnalytics
 187 {
 188     __weak __typeof(self) weakSelf = self;
 189
 190     // Tests shouldn't continue here; it leads to entitlement crashes with CloudKit if the mocks aren't enabled when this function runs
 191     if(SecCKKSTestsEnabled()) {
 192         return;
 193     }
 194
 195     [[CKKSAnalytics logger] AddMultiSamplerForName:@"CKKS-healthSummary" withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
 196         __strong __typeof(self) strongSelf = weakSelf;
 197         if(!strongSelf) {
 198             return nil;
 199         }
 200
 201         NSMutableDictionary* values = [NSMutableDictionary dictionary];
 202         BOOL inCircle = (strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle);
 203         if (inCircle) {
 204             [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastInCircle];
 205         }
 206         values[CKKSAnalyticsInCircle] = @(inCircle);
 207
 208         BOOL validCredentials = strongSelf.accountTracker.currentCKAccountInfo.hasValidCredentials;
 209         if (!validCredentials) {
 210             values[CKKSAnalyticsValidCredentials] = @(validCredentials);
 211         }
 212
 213         NSArray<NSString *>* keys = @[ CKKSAnalyticsLastUnlock, CKKSAnalyticsLastInCircle];
 214         for (NSString * key in keys) {
 215             NSDate *date = [[CKKSAnalytics logger] datePropertyForKey:key];
 216             values[key] = @([CKKSAnalytics fuzzyDaysSinceDate:date]);
 217         }
 218         return values;
 219     }];
 220
 221     for (NSString* viewName in [self viewList]) {
 222         [[CKKSAnalytics logger] AddMultiSamplerForName:[NSString stringWithFormat:@"CKKS-%@-healthSummary", viewName] withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
 223             __strong __typeof(self) strongSelf = weakSelf;
 224             if(!strongSelf) {
 225                 return nil;
 226             }
 227             BOOL inCircle = strongSelf.accountTracker && strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle;
 228             NSMutableDictionary* values = [NSMutableDictionary dictionary];
 229             CKKSKeychainView* view = [strongSelf findOrCreateView:viewName];
 230             NSDate* dateOfLastSyncClassA = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassA inView:view];
 231             NSDate* dateOfLastSyncClassC = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassC inView:view];
 232             NSDate* dateOfLastKSR = [[CKKSAnalytics logger] datePropertyForKey:CKKSAnalyticsLastKeystateReady inView:view];
 233
 234             NSInteger fuzzyDaysSinceClassASync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassA];
 235             NSInteger fuzzyDaysSinceClassCSync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassC];
 236             NSInteger fuzzyDaysSinceKSR = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastKSR];
 237             [values setValue:@(fuzzyDaysSinceClassASync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassASync", viewName]];
 238             [values setValue:@(fuzzyDaysSinceClassCSync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassCSync", viewName]];
 239             [values setValue:@(fuzzyDaysSinceKSR) forKey:[NSString stringWithFormat:@"%@-daysSinceLastKeystateReady", viewName]];
 240
 241             BOOL hasTLKs = [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReady] || [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReadyPendingUnlock];
 242             /* only synced recently if between [0...7, ie withing 7 days */
 243             BOOL syncedClassARecently = fuzzyDaysSinceClassASync >= 0 && fuzzyDaysSinceClassASync < 7;
 244             BOOL syncedClassCRecently = fuzzyDaysSinceClassCSync >= 0 && fuzzyDaysSinceClassCSync < 7;
 245             BOOL incomingQueueIsErrorFree = view.lastIncomingQueueOperation.error == nil;
 246             BOOL outgoingQueueIsErrorFree = view.lastOutgoingQueueOperation.error == nil;
 247
 248             NSString* hasTLKsKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsHasTLKs];
 249             NSString* syncedClassARecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassARecently];
 250             NSString* syncedClassCRecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassCRecently];
 251             NSString* incomingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsIncomingQueueIsErrorFree];
 252             NSString* outgoingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsOutgoingQueueIsErrorFree];
 253
 254             values[hasTLKsKey] = @(hasTLKs);
 255             values[syncedClassARecentlyKey] = @(syncedClassARecently);
 256             values[syncedClassCRecentlyKey] = @(syncedClassCRecently);
 257             values[incomingQueueIsErrorFreeKey] = @(incomingQueueIsErrorFree);
 258             values[outgoingQueueIsErrorFreeKey] = @(outgoingQueueIsErrorFree);
 259
 260             BOOL weThinkWeAreInSync = inCircle && hasTLKs && syncedClassARecently && syncedClassCRecently && incomingQueueIsErrorFree && outgoingQueueIsErrorFree;
 261             NSString* inSyncKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsInSync];
 262             values[inSyncKey] = @(weThinkWeAreInSync);
 263
 264             return values;
 265         }];
 266     }
 267 }
 268
 269 -(void)dealloc {
 270     [self clearAllViews];
 271 }
 272
 273 dispatch_queue_t globalZoneStateQueue = NULL;
 274 dispatch_once_t globalZoneStateQueueOnce;
 275
 276 // We can't load the rate limiter in an init method, as the method might end up calling itself (if the database layer isn't yet initialized).
 277 // Lazy-load it here.
 278 - (CKKSRateLimiter*)getGlobalRateLimiter {
 279     dispatch_once(&globalZoneStateQueueOnce, ^{
 280         globalZoneStateQueue = dispatch_queue_create("CKKS global zone state", DISPATCH_QUEUE_SERIAL);
 281     });
 282
 283     if(_globalRateLimiter != nil) {
 284         return _globalRateLimiter;
 285     }
 286
 287     __block CKKSRateLimiter* blocklimit = nil;
 288
 289     dispatch_sync(globalZoneStateQueue, ^{
 290         NSError* error = nil;
 291
 292         // Special object containing state for all zones. Currently, just the rate limiter.
 293         CKKSZoneStateEntry* allEntry = [CKKSZoneStateEntry tryFromDatabase: @"all" error:&error];
 294
 295         if(error) {
 296             secerror("CKKSViewManager: couldn't load global zone state: %@", error);
 297         }
 298
 299         if(!error && allEntry.rateLimiter) {
 300             blocklimit = allEntry.rateLimiter;
 301         } else {
 302             blocklimit = [[CKKSRateLimiter alloc] init];
 303         }
 304     });
 305     _globalRateLimiter = blocklimit;
 306     return _globalRateLimiter;
 307 }
 308
 309 - (void)lockStateChangeNotification:(bool)unlocked
 310 {
 311     if (unlocked) {
 312         [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastUnlock];
 313     }
 314 }
 315
 316 // Mostly exists to be mocked out.
 317 -(NSSet*)viewList {
 318     return CFBridgingRelease(SOSViewCopyViewSet(kViewSetCKKS));
 319 }
 320
 321 - (void)setView: (CKKSKeychainView*) obj {
 322     CKKSKeychainView* kcv = nil;
 323
 324     @synchronized(self.views) {
 325         kcv = self.views[obj.zoneName];
 326         self.views[obj.zoneName] = obj;
 327     }
 328
 329     if(kcv) {
 330         [kcv cancelAllOperations];
 331     }
 332 }
 333
 334 - (void)clearAllViews {
 335     NSArray<CKKSKeychainView*>* tempviews = nil;
 336     @synchronized(self.views) {
 337         tempviews = [self.views.allValues copy];
 338         [self.views removeAllObjects];
 339     }
 340
 341     for(CKKSKeychainView* view in tempviews) {
 342         [view cancelAllOperations];
 343     }
 344 }
 345
 346 - (void)clearView:(NSString*) viewName {
 347     CKKSKeychainView* kcv = nil;
 348     @synchronized(self.views) {
 349         kcv = self.views[viewName];
 350         self.views[viewName] = nil;
 351     }
 352
 353     if(kcv) {
 354         [kcv cancelAllOperations];
 355     }
 356 }
 357
 358 - (CKKSKeychainView*)findView:(NSString*)viewName {
 359     if(!viewName) {
 360         return nil;
 361     }
 362     @synchronized(self.views) {
 363         return self.views[viewName];
 364     }
 365 }
 366
 367 - (CKKSKeychainView*)findOrCreateView:(NSString*)viewName {
 368     @synchronized(self.views) {
 369         CKKSKeychainView* kcv = self.views[viewName];
 370         if(kcv) {
 371             return kcv;
 372         }
 373
 374         self.views[viewName] = [[CKKSKeychainView alloc] initWithContainer: self.container
 375                                                                   zoneName: viewName
 376                                                             accountTracker: self.accountTracker
 377                                                           lockStateTracker: self.lockStateTracker
 378                                                        reachabilityTracker: self.reachabilityTracker
 379                                                              changeFetcher:self.zoneChangeFetcher
 380                                                           savedTLKNotifier: self.savedTLKNotifier
 381                                                               peerProvider:self
 382                                       fetchRecordZoneChangesOperationClass: self.fetchRecordZoneChangesOperationClass
 383                                                 fetchRecordsOperationClass: self.fetchRecordsOperationClass
 384                                                        queryOperationClass:self.queryOperationClass
 385                                          modifySubscriptionsOperationClass: self.modifySubscriptionsOperationClass
 386                                            modifyRecordZonesOperationClass: self.modifyRecordZonesOperationClass
 387                                                         apsConnectionClass: self.apsConnectionClass
 388                                                              notifierClass: self.notifierClass];
 389
 390         if(self.initializeNewZones) {
 391             [self.views[viewName] initializeZone];
 392         }
 393
 394         return self.views[viewName];
 395     }
 396 }
 397
 398 - (NSDictionary<NSString *,NSString *> *)activeTLKs
 399 {
 400     NSMutableDictionary<NSString *,NSString *> *tlks = [NSMutableDictionary new];
 401     @synchronized(self.views) {
 402         for (NSString *name in self.views) {
 403             CKKSKeychainView *view = self.views[name];
 404             NSString *tlk = view.lastActiveTLKUUID;
 405             if (tlk) {
 406                 tlks[name] = tlk;
 407             }
 408         }
 409     }
 410     return tlks;
 411 }
 412
 413 - (CKKSKeychainView*)restartZone:(NSString*)viewName {
 414     @synchronized(self.views) {
 415         [self.views[viewName] halt];
 416         self.views[viewName] = nil;
 417     }
 418     return [self findOrCreateView: viewName];
 419 }
 420
 421 // Allows all views to begin initializing, and opens the floodgates so that new views will be initalized immediately
 422 - (void)initializeZones {
 423     if(!SecCKKSIsEnabled()) {
 424         secnotice("ckks", "Not initializing CKKS view set as CKKS is disabled");
 425         return;
 426     }
 427
 428     @synchronized(self.views) {
 429         self.initializeNewZones = true;
 430
 431         NSSet* viewSet = [self viewList];
 432         for(NSString* s in viewSet) {
 433             [self findOrCreateView:s]; // initializes any newly-created views
 434         }
 435     }
 436
 437     [self setupAnalytics];
 438 }
 439
 440 - (NSString*)viewNameForViewHint: (NSString*) viewHint {
 441     // For now, choose view based on viewhints.
 442     if(viewHint && ![viewHint isEqual: [NSNull null]]) {
 443         return viewHint;
 444     }
 445
 446     //  If there isn't a provided view hint, use the "keychain" view if we're testing. Otherwise, nil.
 447     if(SecCKKSTestsEnabled()) {
 448         return @"keychain";
 449     } else {
 450         return nil;
 451     }
 452 }
 453
 454 - (NSString*)viewNameForItem: (SecDbItemRef) item {
 455     CFErrorRef cferror = NULL;
 456     NSString* viewHint = (__bridge NSString*) SecDbItemGetValue(item, &v7vwht, &cferror);
 457
 458     if(cferror) {
 459         secerror("ckks: Couldn't fetch the viewhint for some reason: %@", cferror);
 460         CFReleaseNull(cferror);
 461         viewHint = nil;
 462     }
 463
 464     return [self viewNameForViewHint: viewHint];
 465 }
 466
 467 - (NSString*)viewNameForAttributes: (NSDictionary*) item {
 468     return [self viewNameForViewHint: item[(id)kSecAttrSyncViewHint]];
 469 }
 470
 471 - (void)registerSyncStatusCallback: (NSString*) uuid callback: (SecBoolNSErrorCallback) callback {
 472     // Someone is requesting future notification of this item.
 473     @synchronized(self.pendingSyncCallbacks) {
 474         self.pendingSyncCallbacks[uuid] = callback;
 475     }
 476 }
 477
 478 - (void) handleKeychainEventDbConnection: (SecDbConnectionRef) dbconn source:(SecDbTransactionSource)txionSource added: (SecDbItemRef) added deleted: (SecDbItemRef) deleted {
 479
 480     SecDbItemRef modified = added ? added : deleted;
 481
 482     NSString* viewName = [self viewNameForItem: modified];
 483     NSString* keyViewName = [CKKSKey isItemKeyForKeychainView: modified];
 484
 485     if(keyViewName) {
 486         // This might be some key material for this view! Poke it.
 487         CKKSKeychainView* view = [self findView: keyViewName];
 488
 489         if(!SecCKKSTestDisableKeyNotifications()) {
 490             ckksnotice("ckks", view, "Potential new key material from %@ (source %lu)",
 491                        keyViewName, (unsigned long)txionSource);
 492             [view keyStateMachineRequestProcess];
 493         } else {
 494             ckksnotice("ckks", view, "Ignoring potential new key material from %@ (source %lu)",
 495                        keyViewName, (unsigned long)txionSource);
 496         }
 497         return;
 498     }
 499
 500     // When SOS is in charge of a view, CKKS is not.
 501     // Since this isn't a CKKS key item, we don't care about it.
 502     if(txionSource == kSecDbSOSTransaction) {
 503         secinfo("ckks", "Ignoring new non-CKKS item in kSecDbSOSTransaction notification");
 504     }
 505
 506     // Looks like a normal item. Proceed!
 507     CKKSKeychainView* view = [self findView:viewName];
 508
 509     NSString* uuid = (__bridge NSString*) SecDbItemGetValue(modified, &v10itemuuid, NULL);
 510     SecBoolNSErrorCallback syncCallback = nil;
 511     if(uuid) {
 512         @synchronized(self.pendingSyncCallbacks) {
 513             syncCallback = self.pendingSyncCallbacks[uuid];
 514             self.pendingSyncCallbacks[uuid] = nil;
 515
 516             if(syncCallback) {
 517                 secinfo("ckks", "Have a pending callback for %@; passing along", uuid);
 518             }
 519         }
 520     }
 521
 522     if(!view) {
 523         secinfo("ckks", "No CKKS view for %@, skipping: %@", viewName, modified);
 524         if(syncCallback) {
 525             syncCallback(false, [NSError errorWithDomain:@"securityd"
 526                                                     code:kSOSCCNoSuchView
 527                                                 userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No syncing view for '%@'", viewName]}]);
 528         }
 529         return;
 530     }
 531
 532     ckksnotice("ckks", view, "Routing item to zone %@: %@", viewName, modified);
 533     [view handleKeychainEventDbConnection: dbconn added:added deleted:deleted rateLimiter:self.globalRateLimiter syncCallback: syncCallback];
 534 }
 535
 536 -(void)setCurrentItemForAccessGroup:(NSData* _Nonnull)newItemPersistentRef
 537                                hash:(NSData*)newItemSHA1
 538                         accessGroup:(NSString*)accessGroup
 539                          identifier:(NSString*)identifier
 540                            viewHint:(NSString*)viewHint
 541                           replacing:(NSData* _Nullable)oldCurrentItemPersistentRef
 542                                hash:(NSData*)oldItemSHA1
 543                            complete:(void (^) (NSError* operror)) complete
 544 {
 545     CKKSKeychainView* view = [self findView:viewHint];
 546
 547     if(!view) {
 548         secnotice("ckks", "No CKKS view for %@, skipping current request", viewHint);
 549         complete([NSError errorWithDomain:CKKSErrorDomain
 550                                      code:CKKSNoSuchView
 551                               description:[NSString stringWithFormat: @"No syncing view for view hint '%@'", viewHint]]);
 552         return;
 553     }
 554
 555     [view setCurrentItemForAccessGroup:newItemPersistentRef
 556                                   hash:newItemSHA1
 557                            accessGroup:accessGroup
 558                             identifier:identifier
 559                              replacing:oldCurrentItemPersistentRef
 560                                   hash:oldItemSHA1
 561                               complete:complete];
 562 }
 563
 564 -(void)getCurrentItemForAccessGroup:(NSString*)accessGroup
 565                          identifier:(NSString*)identifier
 566                            viewHint:(NSString*)viewHint
 567                     fetchCloudValue:(bool)fetchCloudValue
 568                            complete:(void (^) (NSString* uuid, NSError* operror)) complete
 569 {
 570     CKKSKeychainView* view = [self findView:viewHint];
 571     if(!view) {
 572         secnotice("ckks", "No CKKS view for %@, skipping current fetch request", viewHint);
 573         complete(NULL, [NSError errorWithDomain:CKKSErrorDomain
 574                                            code:CKKSNoSuchView
 575                                     description:[NSString stringWithFormat: @"No view for '%@'", viewHint]]);
 576         return;
 577     }
 578
 579     [view getCurrentItemForAccessGroup:accessGroup
 580                             identifier:identifier
 581                        fetchCloudValue:fetchCloudValue
 582                               complete:complete];
 583 }
 584
 585
 586 + (instancetype) manager {
 587     return [self resetManager: false setTo: nil];
 588 }
 589
 590 + (instancetype) resetManager: (bool) reset setTo: (CKKSViewManager*) obj {
 591     static CKKSViewManager* manager = nil;
 592
 593     if([CKDatabase class] == nil) {
 594         secerror("CKKS: CloudKit.framework appears to not be linked. Can't create CKKS objects.");
 595         return nil;
 596     }
 597
 598     if(!manager || reset || obj) {
 599         @synchronized([self class]) {
 600             if(obj != nil) {
 601                 [manager clearAllViews];
 602                 manager = obj;
 603             } else {
 604                 if(reset) {
 605                     [manager clearAllViews];
 606                     manager = nil;
 607                 } else if (manager == nil && SecCKKSIsEnabled()) {
 608                     manager = [[CKKSViewManager alloc] initCloudKitWithContainerName:SecCKKSContainerName usePCS:SecCKKSContainerUsePCS];
 609                 }
 610             }
 611         }
 612     }
 613
 614     return manager;
 615 }
 616
 617 - (void)cancelPendingOperations {
 618     [self.savedTLKNotifier cancel];
 619 }
 620
 621 -(void)notifyNewTLKsInKeychain {
 622     // Why two functions here? Limitation of OCMock, unfortunately: can't stub and expect the same method
 623     secnotice("ckksbackup", "New TLKs have arrived");
 624     [self syncBackupAndNotifyAboutSync];
 625 }
 626
 627 - (void)syncBackupAndNotifyAboutSync {
 628     SOSAccount* account = (__bridge SOSAccount*)SOSKeychainAccountGetSharedAccount();
 629
 630     if(!account) {
 631         secnotice("ckks", "Failed to get account object");
 632         return;
 633     }
 634
 635     [account performTransaction:^(SOSAccountTransaction * _Nonnull txn) {
 636         CFErrorRef error = NULL;
 637         NSSet* ignore = CFBridgingRelease(SOSAccountCopyBackupPeersAndForceSync(txn, &error));
 638         (void)ignore;
 639
 640         if(error) {
 641             secerror("ckksbackup: Couldn't process sync with backup peers: %@", error);
 642         } else {
 643             secnotice("ckksbackup", "telling CloudServices about TLK arrival");
 644             notify_post(kSecItemBackupNotification);
 645         };
 646     }];
 647 }
 648
 649 #pragma mark - RPCs to manage and report state
 650
 651 - (void)performanceCounters:(void(^)(NSDictionary <NSString *, NSNumber *> *counter))reply {
 652     reply(@{});
 653 }
 654
 655 - (NSArray<CKKSKeychainView*>*)views:(NSString*)viewName operation:(NSString*)opName error:(NSError**)error
 656 {
 657     NSArray* actualViews = nil;
 658
 659     // Ensure we've actually set up, but don't wait too long. Clients get impatient.
 660     if([self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]) {
 661         secerror("ckks: Haven't yet initialized zones; expect failure fetching views");
 662     }
 663
 664     @synchronized(self.views) {
 665         if(viewName) {
 666             CKKSKeychainView* view = self.views[viewName];
 667             secnotice("ckks", "Received a %@ request for zone %@ (%@)", opName, viewName, view);
 668
 669             if(!view) {
 670                 if(error) {
 671                     *error = [NSError errorWithDomain:CKKSErrorDomain
 672                                                  code:CKKSNoSuchView
 673                                              userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No view for '%@'", viewName]}];
 674                 }
 675                 return nil;
 676             }
 677
 678             actualViews = @[view];
 679         } else {
 680             actualViews = [self.views.allValues copy];
 681             secnotice("ckks", "Received a %@ request for all zones: %@", opName, actualViews);
 682         }
 683     }
 684     actualViews = [actualViews sortedArrayUsingDescriptors:@[[NSSortDescriptor sortDescriptorWithKey:@"zoneName" ascending:YES]]];
 685     return actualViews;
 686 }
 687
 688 - (void)rpcResetLocal:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 689     NSError* localError = nil;
 690     NSArray* actualViews = [self views:viewName operation:@"local reset" error:&localError];
 691     if(localError) {
 692         secerror("ckks: Error getting view %@: %@", viewName, localError);
 693         reply(localError);
 694         return;
 695     }
 696
 697     CKKSResultOperation* op = [CKKSResultOperation named:@"local-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
 698         if(!strongOp.error) {
 699             secnotice("ckksreset", "Completed rpcResetLocal");
 700         } else {
 701             secnotice("ckks", "Completed rpcResetLocal with error: %@", strongOp.error);
 702         }
 703         reply(CKXPCSuitableError(strongOp.error));
 704     }];
 705
 706     for(CKKSKeychainView* view in actualViews) {
 707         ckksnotice("ckksreset", view, "Beginning local reset for %@", view);
 708         [op addSuccessDependency:[view resetLocalData]];
 709     }
 710
 711     [op timeout:120*NSEC_PER_SEC];
 712     [self.operationQueue addOperation: op];
 713 }
 714
 715 #pragma clang diagnostic push
 716 #pragma clang diagnostic ignored "-Wdeprecated-implementations"
 717 - (void)rpcResetCloudKit:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 718     [self rpcResetCloudKit:viewName reason:@"unknown" reply:reply];
 719 }
 720 #pragma clang diagnostic pop
 721
 722 - (void)rpcResetCloudKit:(NSString*)viewName reason:(NSString *)reason reply:(void(^)(NSError* result)) reply {
 723     NSError* localError = nil;
 724     NSArray* actualViews = [self views:viewName operation:@"CloudKit reset" error:&localError];
 725     if(localError) {
 726         secerror("ckks: Error getting view %@: %@", viewName, localError);
 727         reply(localError);
 728         return;
 729     }
 730
 731     CKKSResultOperation* op = [CKKSResultOperation named:@"cloudkit-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
 732         if(!strongOp.error) {
 733             secnotice("ckksreset", "Completed rpcResetCloudKit");
 734         } else {
 735             secnotice("ckksreset", "Completed rpcResetCloudKit with error: %@", strongOp.error);
 736         }
 737         reply(CKXPCSuitableError(strongOp.error));
 738     }];
 739
 740     for(CKKSKeychainView* view in actualViews) {
 741         NSString *operationGroupName = [NSString stringWithFormat:@"api-reset-%@", reason];
 742         ckksnotice("ckksreset", view, "Beginning CloudKit reset for %@: %@", view, reason);
 743         [op addSuccessDependency:[view resetCloudKitZone:[CKOperationGroup CKKSGroupWithName:operationGroupName]]];
 744     }
 745
 746     [op timeout:120*NSEC_PER_SEC];
 747     [self.operationQueue addOperation: op];
 748 }
 749
 750 - (void)rpcResync:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 751     NSError* localError = nil;
 752     NSArray* actualViews = [self views:viewName operation:@"CloudKit resync" error:&localError];
 753     if(localError) {
 754         secerror("ckks: Error getting view %@: %@", viewName, localError);
 755         reply(localError);
 756         return;
 757     }
 758
 759     CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
 760     op.name = @"rpc-resync-cloudkit";
 761     __weak __typeof(op) weakOp = op;
 762     [op addExecutionBlock:^{
 763         __strong __typeof(op) strongOp = weakOp;
 764         secnotice("ckks", "Ending rsync-CloudKit rpc with %@", strongOp.error);
 765     }];
 766
 767     for(CKKSKeychainView* view in actualViews) {
 768         ckksnotice("ckksresync", view, "Beginning resync (CloudKit) for %@", view);
 769
 770         CKKSSynchronizeOperation* resyncOp = [view resyncWithCloud];
 771         [op addSuccessDependency:resyncOp];
 772     }
 773
 774     [op timeout:120*NSEC_PER_SEC];
 775     [self.operationQueue addOperation:op];
 776     [op waitUntilFinished];
 777     reply(CKXPCSuitableError(op.error));
 778 }
 779
 780 - (void)rpcResyncLocal:(NSString*)viewName reply:(void(^)(NSError* result))reply {
 781     NSError* localError = nil;
 782     NSArray* actualViews = [self views:viewName operation:@"local resync" error:&localError];
 783     if(localError) {
 784         secerror("ckks: Error getting view %@: %@", viewName, localError);
 785         reply(localError);
 786         return;
 787     }
 788
 789     CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
 790     op.name = @"rpc-resync-local";
 791     __weak __typeof(op) weakOp = op;
 792     [op addExecutionBlock:^{
 793         __strong __typeof(op) strongOp = weakOp;
 794         secnotice("ckks", "Ending rsync-local rpc with %@", strongOp.error);
 795         reply(CKXPCSuitableError(strongOp.error));
 796     }];
 797
 798     for(CKKSKeychainView* view in actualViews) {
 799         ckksnotice("ckksresync", view, "Beginning resync (local) for %@", view);
 800
 801         CKKSLocalSynchronizeOperation* resyncOp = [view resyncLocal];
 802         [op addSuccessDependency:resyncOp];
 803     }
 804
 805     [op timeout:120*NSEC_PER_SEC];
 806 }
 807
 808 - (void)rpcStatus: (NSString*)viewName reply: (void(^)(NSArray<NSDictionary*>* result, NSError* error)) reply {
 809     NSMutableArray* a = [[NSMutableArray alloc] init];
 810
 811     // Now, query the views about their status
 812     NSError* error = nil;
 813     NSArray* actualViews = [self views:viewName operation:@"status" error:&error];
 814     if(!actualViews || error) {
 815         reply(nil, error);
 816         return;
 817     }
 818
 819     __weak __typeof(self) weakSelf = self;
 820     CKKSResultOperation* statusOp = [CKKSResultOperation named:@"status-rpc" withBlock:^{
 821         __strong __typeof(self) strongSelf = weakSelf;
 822
 823         // The first element is always the current global state (non-view-specific)
 824         NSError* selfPeersError = nil;
 825         CKKSSelves* selves = [strongSelf fetchSelfPeers:&selfPeersError];
 826         NSError* trustedPeersError = nil;
 827         NSSet<id<CKKSPeer>>* peers = [strongSelf fetchTrustedPeers:&trustedPeersError];
 828
 829         // Get account state, even wait for it a little
 830         [self.accountTracker.ckdeviceIDInitialized wait:1*NSEC_PER_SEC];
 831         NSString *deviceID = self.accountTracker.ckdeviceID;
 832         NSError *deviceIDError = self.accountTracker.ckdeviceIDError;
 833
 834         NSMutableArray<NSString*>* mutTrustedPeers = [[NSMutableArray alloc] init];
 835         [peers enumerateObjectsUsingBlock:^(id<CKKSPeer>  _Nonnull obj, BOOL * _Nonnull stop) {
 836             [mutTrustedPeers addObject: [obj description]];
 837         }];
 838
 839 #define stringify(obj) CKKSNilToNSNull([obj description])
 840         NSDictionary* global = @{
 841                                  @"view":                @"global",
 842                                  @"selfPeers":           stringify(selves),
 843                                  @"selfPeersError":      CKKSNilToNSNull(selfPeersError),
 844                                  @"trustedPeers":        CKKSNilToNSNull(mutTrustedPeers),
 845                                  @"trustedPeersError":   CKKSNilToNSNull(trustedPeersError),
 846                                  @"reachability":        strongSelf.reachabilityTracker.currentReachability ? @"network" : @"no-network",
 847                                  @"ckdeviceID":          CKKSNilToNSNull(deviceID),
 848                                  @"ckdeviceIDError":     CKKSNilToNSNull(deviceIDError),
 849         };
 850         [a addObject: global];
 851
 852         for(CKKSKeychainView* view in actualViews) {
 853             ckksnotice("ckks", view, "Fetching status for %@", view.zoneName);
 854             NSDictionary* status = [view status];
 855             ckksinfo("ckks", view, "Status is %@", status);
 856             if(status) {
 857                 [a addObject: status];
 858             }
 859         }
 860         reply(a, nil);
 861     }];
 862
 863     // If we're signed in, give the views a few seconds to enter what they consider to be a non-transient state (in case this daemon just launched)
 864     if([self.accountTracker.currentComputedAccountStatusValid wait:5*NSEC_PER_SEC]) {
 865         secerror("ckks status: Haven't yet figured out login state");
 866     }
 867
 868     if(self.accountTracker.currentComputedAccountStatus == CKKSAccountStatusAvailable) {
 869         CKKSResultOperation* blockOp = [CKKSResultOperation named:@"wait-for-status" withBlock:^{}];
 870         [blockOp timeout:8*NSEC_PER_SEC];
 871         for(CKKSKeychainView* view in actualViews) {
 872             [blockOp addNullableDependency:view.keyStateNonTransientDependency];
 873             [statusOp addDependency:blockOp];
 874         }
 875         [self.operationQueue addOperation:blockOp];
 876     }
 877     [self.operationQueue addOperation:statusOp];
 878
 879     return;
 880 }
 881
 882 - (void)rpcFetchAndProcessChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 883     [self rpcFetchAndProcessChanges:viewName classA:false reply: (void(^)(NSError* result))reply];
 884 }
 885
 886 - (void)rpcFetchAndProcessClassAChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 887     [self rpcFetchAndProcessChanges:viewName classA:true reply:(void(^)(NSError* result))reply];
 888 }
 889
 890 - (void)rpcFetchAndProcessChanges:(NSString*)viewName classA:(bool)classAError reply: (void(^)(NSError* result)) reply {
 891     NSError* error = nil;
 892     NSArray* actualViews = [self views:viewName operation:@"fetch" error:&error];
 893     if(!actualViews || error) {
 894         reply(error);
 895         return;
 896     }
 897
 898     CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
 899     blockOp.name = @"rpc-fetch-and-process-result";
 900     __weak __typeof(blockOp) weakBlockOp = blockOp;
 901     // Use the completion block instead of the operation block, so that it runs even if the cancel fires
 902     [blockOp setCompletionBlock:^{
 903         __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
 904         [strongBlockOp allDependentsSuccessful];
 905         reply(CKXPCSuitableError(strongBlockOp.error));
 906     }];
 907
 908     for(CKKSKeychainView* view in actualViews) {
 909         ckksnotice("ckks", view, "Beginning fetch for %@", view);
 910
 911         CKKSResultOperation* op = [view processIncomingQueue:classAError after:[view.zoneChangeFetcher requestSuccessfulFetch: CKKSFetchBecauseAPIFetchRequest]];
 912         [blockOp addDependency:op];
 913     }
 914
 915     [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 5 : NSEC_PER_SEC * 120)]];
 916 }
 917
 918 - (void)rpcPushOutgoingChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 919     NSError* error = nil;
 920     NSArray* actualViews = [self views:viewName operation:@"push" error:&error];
 921     if(!actualViews || error) {
 922         reply(error);
 923         return;
 924     }
 925
 926     CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
 927     blockOp.name = @"rpc-push";
 928     __weak __typeof(blockOp) weakBlockOp = blockOp;
 929     // Use the completion block instead of the operation block, so that it runs even if the cancel fires
 930     [blockOp setCompletionBlock:^{
 931         __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
 932         [strongBlockOp allDependentsSuccessful];
 933         reply(CKXPCSuitableError(strongBlockOp.error));
 934     }];
 935
 936     for(CKKSKeychainView* view in actualViews) {
 937         ckksnotice("ckks-rpc", view, "Beginning push for %@", view);
 938
 939         CKKSResultOperation* op = [view processOutgoingQueue: [CKOperationGroup CKKSGroupWithName:@"rpc-push"]];
 940         [blockOp addDependency:op];
 941     }
 942
 943     [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 2 : NSEC_PER_SEC * 120)]];
 944 }
 945
 946 - (void)rpcGetCKDeviceIDWithReply:(void (^)(NSString *))reply {
 947     reply(self.accountTracker.ckdeviceID);
 948 }
 949
 950 -(void)xpc24HrNotification {
 951     // XPC has poked us and said we should do some cleanup!
 952
 953     // For now, poke the views and tell them to update their device states if they'd like
 954     NSArray* actualViews = nil;
 955     @synchronized(self.views) {
 956         // Can't safely iterate a mutable collection, so copy it.
 957         actualViews = self.views.allValues;
 958     }
 959
 960     secnotice("ckks", "Received a 24hr notification from XPC");
 961     CKOperationGroup* group = [CKOperationGroup CKKSGroupWithName:@"periodic-device-state-update"];
 962     for(CKKSKeychainView* view in actualViews) {
 963         ckksnotice("ckks", view, "Starting device state XPC update");
 964         // Let the update know it should rate-limit itself
 965         [view updateDeviceState:true waitForKeyHierarchyInitialization:30*NSEC_PER_SEC ckoperationGroup:group];
 966     }
 967 }
 968
 969 - (NSArray<NSDictionary *> * _Nullable)loadRestoredBottledKeysOfType:(OctagonKeyType)keyType error:(NSError**)error
 970 {
 971     CFTypeRef result = NULL;
 972     NSMutableArray* bottledPeerKeychainItems = nil;
 973
 974     NSDictionary* query = @{
 975                             (id)kSecClass : (id)kSecClassInternetPassword,
 976                             (id)kSecAttrAccessible: (id)kSecAttrAccessibleWhenUnlocked,
 977                             (id)kSecAttrNoLegacy : @YES,
 978                             (id)kSecAttrType : [[NSNumber alloc]initWithInt: keyType],
 979                             (id)kSecAttrServer : (keyType == 1) ? @"Octagon Signing Key" : @"Octagon Encryption Key",
 980                             (id)kSecAttrAccessGroup: @"com.apple.security.ckks",
 981                             (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 982                             (id)kSecReturnAttributes: @YES,
 983                             (id)kSecReturnData: @YES,
 984                             };
 985     OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
 986
 987     if(status == errSecSuccess && result && isArray(result)) {
 988         bottledPeerKeychainItems = CFBridgingRelease(result);
 989         result = NULL;
 990     } else {
 991         if(error) {
 992             *error = [NSError errorWithDomain:NSOSStatusErrorDomain
 993                                          code:status
 994                                   description:@"could not load bottled peer keys"];
 995         }
 996         CFReleaseNull(result);
 997     }
 998
 999     return bottledPeerKeychainItems;
1000 }
1001
1002 -(NSDictionary *) keychainItemForPeerID:(NSString*)neededPeerID
1003                           keychainItems:(NSArray<NSDictionary*> *)keychainItems
1004                 escrowSigningPubKeyHash:(NSString *)hashWeNeedToMatch
1005 {
1006     NSDictionary* peerItem = nil;
1007
1008     for(NSDictionary* item in keychainItems){
1009         if(item && [item count] > 0){
1010             NSString* peerIDFromItem = [item objectForKey:(id)kSecAttrAccount];
1011             NSString* hashToConsider = [item objectForKey:(id)kSecAttrLabel];
1012             if([peerIDFromItem isEqualToString:neededPeerID] &&
1013                [hashWeNeedToMatch isEqualToString:hashToConsider])
1014             {
1015                 peerItem = [item copy];
1016                 break;
1017             }
1018         }
1019     }
1020
1021     return peerItem;
1022 }
1023
1024 - (NSSet<id<CKKSSelfPeer>>*)pastSelves:(NSError**)error
1025 {
1026     NSError* localError = nil;
1027
1028     // get bottled peer identities from the keychain
1029     NSMutableSet<id<CKKSSelfPeer>>* allSelves = [NSMutableSet set];
1030     NSArray<NSDictionary*>* signingKeys = [self loadRestoredBottledKeysOfType:OctagonSigningKey error:&localError];
1031     if(!signingKeys) {
1032         // Item not found isn't actually an error here
1033         if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1034             *error = localError;
1035         }
1036
1037         return allSelves;
1038     }
1039
1040     NSArray<NSDictionary*>* encryptionKeys = [self loadRestoredBottledKeysOfType:OctagonEncryptionKey error:&localError];
1041     if(!encryptionKeys) {
1042         if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1043             *error = localError;
1044         }
1045         return allSelves;
1046     }
1047
1048     for(NSDictionary* signingKey in signingKeys) {
1049         NSError* peerError = nil;
1050         NSString* peerid = signingKey[(id)kSecAttrAccount];
1051         NSString* hash = signingKey[(id)kSecAttrLabel]; // escrow signing pub key hash
1052
1053         //use peer id AND escrow signing public key hash to look up the matching item in encryptionKeys list
1054         NSDictionary* encryptionKeyItem = [self keychainItemForPeerID:peerid keychainItems:encryptionKeys escrowSigningPubKeyHash:hash];
1055         if(!encryptionKeyItem) {
1056             secerror("octagon: no encryption key available to pair with signing key %@,%@", peerid, hash);
1057             continue;
1058         }
1059
1060         NSData* signingKeyData = signingKey[(id)kSecValueData];
1061         if(!signingKeyData) {
1062             secerror("octagon: no signing key data for %@,%@", peerid,hash);
1063             continue;
1064         }
1065
1066         SFECKeyPair* restoredSigningKey = [[SFECKeyPair alloc] initWithData:signingKeyData
1067                                                                   specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1068                                                                       error:&peerError];
1069         if(!restoredSigningKey) {
1070             secerror("octagon: couldn't make signing key for %@,%@: %@", peerid, hash, peerError);
1071             continue;
1072         }
1073
1074         NSData* encryptionKeyData = [encryptionKeyItem objectForKey:(id)kSecValueData];
1075         if(!encryptionKeyData) {
1076             secerror("octagon: no encryption key data for %@,%@", peerid,hash);
1077             continue;
1078         }
1079
1080         SFECKeyPair* restoredEncryptionKey = [[SFECKeyPair alloc] initWithData:encryptionKeyData
1081                                                                      specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1082                                                                          error:&peerError];
1083         if(!restoredEncryptionKey) {
1084             secerror("octagon: couldn't make encryption key for %@,%@: %@", peerid,hash, peerError);
1085             continue;
1086         }
1087
1088         //create the SOS self peer
1089         CKKSSOSSelfPeer* restoredIdentity = [[CKKSSOSSelfPeer alloc]initWithSOSPeerID:peerid encryptionKey:restoredEncryptionKey signingKey:restoredSigningKey];
1090
1091         if(restoredIdentity){
1092             secnotice("octagon","adding bottled peer identity: %@", restoredIdentity);
1093             [allSelves addObject:restoredIdentity];
1094         } else {
1095             secerror("octagon: could not create restored identity from: %@: %@", peerid, peerError);
1096         }
1097     }
1098     return allSelves;
1099 }
1100
1101 - (id<CKKSSelfPeer> _Nullable)currentSOSSelf:(NSError**)error
1102 {
1103     __block SFECKeyPair* signingPrivateKey = nil;
1104     __block SFECKeyPair* encryptionPrivateKey = nil;
1105
1106     __block NSError* localerror = nil;
1107
1108     // Wait for this to initialize, but don't worry if it isn't.
1109     [self.accountTracker.accountCirclePeerIDInitialized wait:500*NSEC_PER_MSEC];
1110     NSString* peerID = self.accountTracker.accountCirclePeerID;
1111     if(!peerID || self.accountTracker.accountCirclePeerIDError) {
1112         secerror("ckkspeer: Error fetching self peer : %@", self.accountTracker.accountCirclePeerIDError);
1113         if(error) {
1114             *error = self.accountTracker.accountCirclePeerIDError;
1115         }
1116         return nil;
1117     }
1118
1119     SOSCCPerformWithAllOctagonKeys(^(SecKeyRef octagonEncryptionKey, SecKeyRef octagonSigningKey, CFErrorRef cferror) {
1120         if(cferror) {
1121             localerror = (__bridge NSError*)cferror;
1122             return;
1123         }
1124         if (!cferror && octagonEncryptionKey && octagonSigningKey) {
1125             signingPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonSigningKey];
1126             encryptionPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonEncryptionKey];
1127         } else {
1128             localerror = [NSError errorWithDomain:CKKSErrorDomain
1129                                              code:CKKSNoPeersAvailable
1130                                       description:@"Not all SOS peer keys available, but no error returned"];
1131         }
1132     });
1133
1134     if(localerror) {
1135         if(![self.lockStateTracker isLockedError:localerror]) {
1136             secerror("ckkspeer: Error fetching self encryption keys: %@", localerror);
1137         }
1138         if(error) {
1139             *error = localerror;
1140         }
1141         return nil;
1142     }
1143
1144     CKKSSOSSelfPeer* selfPeer = [[CKKSSOSSelfPeer alloc] initWithSOSPeerID:peerID
1145                                                              encryptionKey:encryptionPrivateKey
1146                                                                 signingKey:signingPrivateKey];
1147     return selfPeer;
1148 }
1149
1150 #pragma mark - CKKSPeerProvider implementation
1151
1152 - (CKKSSelves*)fetchSelfPeers:(NSError* __autoreleasing *)error {
1153     NSError* localError = nil;
1154
1155     id<CKKSSelfPeer> selfPeer = [self currentSOSSelf:&localError];
1156     if(!selfPeer || localError) {
1157         if(![self.lockStateTracker isLockedError:localError]) {
1158             secerror("ckks: Error fetching current SOS self: %@", localError);
1159         }
1160         if(error) {
1161             *error = localError;
1162         }
1163         return nil;
1164     }
1165
1166     NSSet<id<CKKSSelfPeer>>* allSelves = [self pastSelves:&localError];
1167     if(!allSelves || localError) {
1168         secerror("ckks: Error fetching past selves: %@", localError);
1169         if(error) {
1170             *error = localError;
1171         }
1172         return nil;
1173     }
1174
1175     CKKSSelves* selves = [[CKKSSelves alloc] initWithCurrent:selfPeer allSelves:allSelves];
1176     return selves;
1177 }
1178
1179 - (NSSet<id<CKKSPeer>>*)fetchTrustedPeers:(NSError* __autoreleasing *)error {
1180     __block NSMutableSet<id<CKKSPeer>>* peerSet = [NSMutableSet set];
1181
1182     SOSCCPerformWithTrustedPeers(^(CFSetRef sosPeerInfoRefs, CFErrorRef cfTrustedPeersError) {
1183         if(cfTrustedPeersError) {
1184             secerror("ckks: Error fetching trusted peers: %@", cfTrustedPeersError);
1185             if(error) {
1186                 *error = (__bridge NSError*)cfTrustedPeersError;
1187             }
1188         }
1189
1190         CFSetForEach(sosPeerInfoRefs, ^(const void* voidPeer) {
1191             CFErrorRef cfPeerError = NULL;
1192             SOSPeerInfoRef sosPeerInfoRef = (SOSPeerInfoRef)voidPeer;
1193
1194             if(!sosPeerInfoRef) {
1195                 return;
1196             }
1197
1198             CFStringRef cfpeerID = SOSPeerInfoGetPeerID(sosPeerInfoRef);
1199             SecKeyRef cfOctagonSigningKey = NULL, cfOctagonEncryptionKey = NULL;
1200
1201             cfOctagonSigningKey = SOSPeerInfoCopyOctagonSigningPublicKey(sosPeerInfoRef, &cfPeerError);
1202             if (cfOctagonSigningKey) {
1203                 cfOctagonEncryptionKey = SOSPeerInfoCopyOctagonEncryptionPublicKey(sosPeerInfoRef, &cfPeerError);
1204             }
1205
1206             if(cfOctagonSigningKey == NULL || cfOctagonEncryptionKey == NULL) {
1207                 // Don't log non-debug for -50; it almost always just means this peer didn't have octagon keys
1208                 if(cfPeerError == NULL
1209                    || !(CFEqualSafe(CFErrorGetDomain(cfPeerError), kCFErrorDomainOSStatus) && (CFErrorGetCode(cfPeerError) == errSecParam)))
1210                 {
1211                     secerror("ckkspeer: error fetching octagon keys for peer: %@ %@", sosPeerInfoRef, cfPeerError);
1212                 } else {
1213                     secinfo("ckkspeer", "Peer(%@) doesn't have Octagon keys, but this is expected: %@", cfpeerID, cfPeerError);
1214                 }
1215             }
1216
1217             // Add all peers to the trust set: old-style SOS peers will just have null keys
1218             SFECPublicKey* signingPublicKey = cfOctagonSigningKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonSigningKey] : nil;
1219             SFECPublicKey* encryptionPublicKey = cfOctagonEncryptionKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonEncryptionKey] : nil;
1220
1221             CKKSSOSPeer* peer = [[CKKSSOSPeer alloc] initWithSOSPeerID:(__bridge NSString*)cfpeerID
1222                                                    encryptionPublicKey:encryptionPublicKey
1223                                                       signingPublicKey:signingPublicKey];
1224             [peerSet addObject:peer];
1225
1226             CFReleaseNull(cfOctagonSigningKey);
1227             CFReleaseNull(cfOctagonEncryptionKey);
1228             CFReleaseNull(cfPeerError);
1229         });
1230     });
1231
1232     return peerSet;
1233 }
1234
1235 - (void)registerForPeerChangeUpdates:(id<CKKSPeerUpdateListener>)listener {
1236     @synchronized(self.peerChangeListeners) {
1237         bool alreadyRegisteredListener = false;
1238         NSEnumerator *enumerator = [self.peerChangeListeners objectEnumerator];
1239         id<CKKSPeerUpdateListener> value;
1240
1241         while ((value = [enumerator nextObject])) {
1242             // do pointer comparison
1243             alreadyRegisteredListener |= (value == listener);
1244         }
1245
1246         if(listener && !alreadyRegisteredListener) {
1247             NSString* queueName = [NSString stringWithFormat: @"ck-peer-change-%@", listener];
1248
1249             dispatch_queue_t objQueue = dispatch_queue_create([queueName UTF8String], DISPATCH_QUEUE_SERIAL);
1250             [self.peerChangeListeners setObject: listener forKey: objQueue];
1251         }
1252     }
1253 }
1254
1255 - (void)iteratePeerListenersOnTheirQueue:(void (^)(id<CKKSPeerUpdateListener>))block {
1256     @synchronized(self.peerChangeListeners) {
1257         NSEnumerator *enumerator = [self.peerChangeListeners keyEnumerator];
1258         dispatch_queue_t dq;
1259
1260         // Queue up the changes for each listener.
1261         while ((dq = [enumerator nextObject])) {
1262             id<CKKSPeerUpdateListener> listener = [self.peerChangeListeners objectForKey: dq];
1263             __weak id<CKKSPeerUpdateListener> weakListener = listener;
1264
1265             if(listener) {
1266                 dispatch_async(dq, ^{
1267                     __strong id<CKKSPeerUpdateListener> strongListener = weakListener;
1268                     block(strongListener);
1269                 });
1270             }
1271         }
1272     }
1273 }
1274
1275 - (void)sendSelfPeerChangedUpdate {
1276     [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1277
1278     [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1279         [listener selfPeerChanged];
1280     }];
1281 }
1282
1283 - (void)sendTrustedPeerSetChangedUpdate {
1284     [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1285
1286     [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1287         [listener trustedPeerSetChanged];
1288     }];
1289 }
1290 #endif // OCTAGON
1291 @end